Installing Qtap on EC2

The environment setup described in this guide involves configuring two separate EC2 instances within AWS: one as an API Client and the other as a Qtap Proxy Server. The API Client EC2 instance is tailored for making API requests, while the Qtap Proxy EC2 instance is configured to act as a gateway for these requests.

Prerequisites:

• EC2 Key Pair: Generate or use an existing EC2 key pair for SSH access.

• Proxy Security Group: Configure a security group with inbound rules allowing traffic on port 10080

• Client Security Group: Configure a security group which can reach the Proxy Security Group

• API Token: Obtain an API token from QPoint for authentication.

Qtap Proxy Installation Steps

Launch Proxy EC2 Instance

• AMI Selection: Choose Amazon Linux 2 AMI.

• Instance Type: Select an appropriate instance type (e.g., t2.small).

• Configure Instance: Attach the created proxy security group.

• Launch: Select your key pair and launch the instance.

SSH into the EC2 Instance

• Connect to your instance using SSH: ssh -i /path/to/key.pem ec2-user@<EC2-instance-public-IP>

Install Docker onto EC2

• Update packages: sudo yum update -y

• Install Docker: sudo amazon-linux-extras install docker

• Start Docker service: sudo service docker start

• Add ec2-user to the Docker group to execute Docker commands without sudo: sudo usermod -a -G docker ec2-user

• Reconnect or log out and back in again to re-evaluate group membership.

Run Qtap API Proxy Docker Container

docker run -d \
  --name qtap-gateway \
  -p 10080:10080 \
  -p 10443:10443 \
  -p 10001:10001 \
  -e endpoint=https://api.qpoint.io \
  us-docker.pkg.dev/qpoint-edge/public/qtap:head \
  gateway --dns-lookup-family=V4_ONLY --envoy-log-level=error --log-level=info --token={API-TOKEN}

Replace {API-TOKEN} with your actual API token.

API Client Installation Steps

Launch EC2 Instance

• AMI Selection: Choose Amazon Linux 2 AMI.

• Instance Type: Select an appropriate instance type (e.g., t2.small).

• Configure Instance: Ensure networking is configured so the client can reach the Proxy Server.

• Launch: Select your key pair and launch the instance.

SSH into the EC2 Instance

• Connect to your instance using SSH: ssh -i /path/to/key.pem ec2-user@<EC2-instance-public-IP>

Install Certificate on the Client

• Certificate Installation: Install the provided certificate on the client issuing requests. This usually involves importing the certificate into the client's trust store or configuring it within the application making the requests. For example:

• Move the Certificate: Move the certificate to an appropriate directory. For system-wide use, /etc/pki/tls/certs is common. For user-specific use, a directory within the user's home directory can be chosen.

  sudo mv /tmp/certificate.pem /etc/pki/tls/certs/

• Update Permissions: Set the appropriate permissions for the certificate file. For example:

  sudo chmod 644 /etc/pki/tls/certs/certificate.pem

• Update CA Trust Store (if necessary): If the certificate needs to be recognized as a trusted CA, update the CA trust store.

  • First, update the CA trust configuration:

    sudo update-ca-trust force-enable

  • Then, copy the certificate to the CA trust source directory and update the trust store:

    sudo cp /etc/pki/tls/certs/certificate.pem /etc/pki/ca-trust/source/anchors/
    sudo update-ca-trust extract

Setting up the HTTPS_PROXY Environment Variable

• Set the Environment Variable: You need to set the HTTPS_PROXY environment variable to route HTTPS requests through the Qtap API Proxy. This can be done using the export command in your shell. Assuming the proxy is running on the proxy EC2 instance and listening on port 10080, the command would be:

  export HTTP_PROXY=http://<proxyhostIP>:10080
  export HTTPS_PROXY=http://<proxyhostIP>:10080

• Verify the Variable: To ensure that the HTTPS_PROXY variable is set correctly, use the echo command:

  echo $HTTPS_PROXY

Testing the Setup with curl

• Basic curl Command: Test the proxy setup with a simple HTTP request using curl. Replace http://example.com with a valid URL you want to test:

  curl -v http://qpoint.io

  The -v flag is for verbose output, which helps in understanding the request and response flow through the proxy.

• Check SSL/TLS Communication: If you need to test HTTPS traffic, use an HTTPS URL. The Qtap API Proxy should handle the SSL/TLS termination:

  curl -v https://qpoint.io

• Troubleshooting: If you encounter issues, the verbose output from curl will provide insights. Common problems could be related to network connectivity, SSL/TLS certificate issues, or misconfigurations in the proxy setup.

• Persisting the Environment Variable: If you want the HTTPS_PROXY setting to persist across sessions, add the export command to your user's shell profile, like ~/.bash_profile or ~/.bashrc.